CVE-2024-38544: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix seg fault in rxecompqueuepkt
In rxecompqueuepkt() an incoming response packet skb is enqueued to the resppkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wrong because if the completer task is already running in a separate thread it may have already processed the skb and freed it which can cause a seg fault. This has been observed infrequently in testing at high scale.
This patch fixes this by changing the order of enqueuing the packet until after the counter is accessed.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix seg fault in rxecompqueuepkt
The Linux kernel CVE team has assigned CVE-2024-38544 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024061949-CVE-2024-38544-601b@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.93 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.33 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38544?
The severity of CVE-2024-38544 is classified as moderate due to the potential for a segmentation fault.
How do I fix CVE-2024-38544?
To fix CVE-2024-38544, upgrade your Linux kernel to version 6.1.93 or higher, or apply the latest security patches from your distribution.
Which Linux kernel versions are affected by CVE-2024-38544?
CVE-2024-38544 affects several versions of the Linux kernel, including versions prior to 6.1.93, 6.6.33, 6.8.12, 6.9.3, and 6.10.
Is there a workaround for CVE-2024-38544?
There is no widely recommended workaround for CVE-2024-38544; applying the update is the best course of action.
What components are impacted by CVE-2024-38544?
CVE-2024-38544 specifically impacts the RDMA/rxe component of the Linux kernel.